I am doing my work in PHP.
I have 3 pages,
A is plain HTML and contains a search field.
B is .php and returns results of the search.
C is also php and allows user to update some details for the displayed results.
When I'm doing Refresh my B page or Go-Back from C to then I
get this message
"To display this page, Firefox must
send information that will repeat any
action (such as a search or order
confirmation) that was performed
earlier."
I saw "When i'm using "POST" method then I get this message, if I'm used GET then
I don't.
Any buddy Explain me ,why???
The GET method should be used to obtain information from a web page.
The POST method should be used to send information to a web page.
The reason it asks you to confirm whether or not to send information again is because it's not always the user's intention to repost a form if they press back. One example is at an online store, you would not want to repost a form to purchase a product twice, otherwise you could be billed for the product twice. This is theoretical of course since someone who makes an online store should ensure that an accidental purchase can't happen.
Also, if you use GET, then all information is appended to the URL of the PHP page. This is a potential security issue, especially if the form contents are private. For such forms, you should be using POST.
A wild guess,
POST is not written in the URL, so you need to resend it, while GET, when you click to return to B, the arguments are still in the URL so you dont need to resend.
Mozilla added this message to warn you from sending the information twice.
Like in the form of registration, you don't want to register twice.
Firefox developers added that warning for POST method. It will warn you for POST in case of back/forward also.
This is an added safeguard for users. Because, most shopping carts/banking portals use POST method for checkout/transaction confirmation (actually I have not seen or developed any web app to use get method for this purpose).
So, Firefox (and most other common browsers) warn you in this scenario (when your are sending POST request indirectly, i.e. using back/forward/refresh button). This prevents the user from multiple checkout.
Another reason to add this warning is, sometimes chekout is time consuming. So, when some time is passed after the original submission, some impatient users think that the browser/server has stopped working. So, they tend to press the refresh button. This warning gives them a good hint.
I think the point is that GET requests should be used to get information without changing anything on the server so if you reload the same information there's no issue. POST requests should be used to change data on the server so when you reload the page that may have undesirable effects.
Firefox should normally allow you to navigate back to your B page from your C page. However if your B page is not in the cache, possibly because it sends a Cache-control: no-store header, then you will get the POSTDATA warning.
On the other hand explicitly reloading page B will always generate a POSTDATA warning.
When you submit data in the POST method, it sends headers to the page you submit to. When you refresh the page or go back, your browser repeats your POST request and Firefox warns you of this.
Related
Here is a tricky question I've been trying to solve...
The issue happens on a mobile website.
I use codeigniter to create a form, pass some values to the db and then redirect the user to the article that the user sent.
The problem is that when in Android WebView (which is a custom app), probably on other mobile devices too, so when the user hits the back button it resends the data and posts the article again. The article is being posted as many time as the user hits the back button, with no warning.
Any suggestions? Has someone had this issue?
Oh and by the way, if the whole history is erased (not sure if that is even possible, because its client side, and I don't fancy using javaScript for that) and the user hits back button, he will be taken out of the app, which I don't want to happen.
Pages that are loaded via POST will cause the browser to ask the user to resubmit the information to view the page resulting in the actions performed by that page happening again. If the pages is requested via GET and has variables in the querystring the same thing happens but silently (without the user being prompted to d it again).
The best to work around this is to use the POST/REDIRECT/GET pattern. I used it in an example about processing payments that I wrote for Authorize.Net. Hopefully that points you in the right direction.
I solve a similar problem ( also in phones ) like this.
Generate a token ( random string of 15 char ) and save in the SESSION['token'] ie.
Save this token in a hidden input in the html form.
when the form is submit, and before touching the db, compare the token submitted with the session one, in case match, proceed and unset() the session token, else error token mismatch.
hope it helps.
My site uses a combo of sessions and get/post.
When user hits back button, it says "confirm you want to resubmit form" or a similar message, depending on the browser. Then the user has to also refresh the page.
How can I make it automatically resubmit form. I don't want users seeing this message and getting stuck when they hit back.
I have PHP + HTML
you can use get method in post method resubmit message is appear and if you want to use post method then on server page use header such as header('location:index.php') and change index page that you want.
Not answering your question, but do reconsider.
POST actions should change the state of the server. GET actions should be transparent. If you're using a POST to submit data to commit to a database or launch nuclear missiles or whatever, the resubmit warning exists for a reason: imagine your embarrassment when you launch two nuclear missiles, but was only trying to launch one.
GET actions, on the other hand, by their specification, should never meaningfully impact the world, so the resubmission is safe. If there is something the user is allowed to go back to, it's a GET page. A POST page should not be returnable-to using the back button (or rather, the user should be made aware of it).
If you have to suppress this warning, you are doing something wrong.
I have a problem with POST and I hope someone can help me. I have two pages, A and B. I need to send some data through POST from A to B, and B can't be modified in any way. How can I send my POST data from A to B, using PHP? The thing is: I don't need to just send the data, I need to go to the page as well, while sending the post, since B creates a cookie that I need.
header + curl? fsockopen? curl only?
not entirely sure what you are asking, or if i am simplifying it but check out this:
http://www.w3schools.com/php/php_post.asp
If all you need to do is send data from page A to page B and then navigate to page B, then set the action of the form to page b, so when you hit the button, you will navigate there.
If something is just too complicated, maybe you're going on the wrong way.
Why do you need such a thing? Can't you just redirect to that page using a form with action="post"? This is the most used way to do what you want, almost every site use this.
If not, tell us the real problem, what you said is a solution to a problem.
Basically you need to create a form and set the action to equal B and the method to 'POST', and then have the data you want to send in input tags and don't forget to give each input tag a name and then add a submit button.
When one clicks on the submit button it will send the data to page B and transfer you to that page
Your question is little unclear .
In page A, you need to set the form action for example then you can get your values in page B and also you will navigated to page B
If you need the cookies fro a different domain to be set to a client / visitor, you'll have to get them there, which essentially means they will have to do the post (doing it with curl from you own server still leaves you with no way to set the cookies). The only feasible solution I can see is to perform a post with client-sided scripting (i.e. javascript).
You cannot let the user do a POST with PHP. Period, no way whatsoever. Sure, you can post from your own server what you like, but it won't do a lick of good as long as you cannot get the cookie information to the client, which you can't due to browser security / privacy issues.
i have create a form (so it's PHP and HTML hybrid-code). it has ability to send '$_POST'. And when i click it, it work perfectly on sending and displaying input.
But there's something happening when i click Ctrl+R in firefox for represhing the page. I got this confim dialog : "To display this page, Firefox must send information that will repeat any action (such as a search or order confirmation) that was performed earlier"
my question
what is it, (this confirm dialog ?)
what i have to do on my code so it able to suppress this dialog ?
You probably have created an HTML page that contains a <form>. The form is used to send data to the HTTP server (that is, the webserver that hosts your site).
The HTTP protocol defines different request types used to send data to the server and to retrieve data from the server. The most used are GET and POST. You must learn about all this if you want to be anything more than a very bad PHP programmer, which is unfortunately (or fortunately, if you are on the hacker side) very common.
Your problem is that Firefox has arrived on the page you are talking about after sending a POST request. If you reload the page, it has to send the same data again in the form of a POST. Due to the conventions on what a POST request should be used for (usually to modify data on a database), the browser asks the user if he is sure about what he wants to do.
There are mainly two options to circumvent this:
Change the form method to GET; or
Use a redirection after the POST.
To use the first method, you could simply add a method="get" parameter to your form tag:
<form action="senddata.php" method="get"> ... </form>
To use the second method, you simply redirect the user after the POST request, using something like
header("Location: blahblahblah")
The most used pattern is the POST-Redirect, that is, the second method I told you about. There are many security implications on using GET to change data on a database (if you are interested on that, and you should be, as every PHP programmer should, read about XSRF).
Submitting a form (sending a POST request) is commonly used to confirm an order on eCommerce sites. Therefore, submitting it twice would submit the order, twice. Therefore browsers, tend to ask for confirmation that a user wants to send the POST request again.
In order to prevent this, you need to make the refresh do a GET request instead of a POST request. To do this, simply redirect to the same page after processing the form.
header("Location: /path/to/self");
This will make it so when the user hits refresh, it will be sending a GET request instead of a POST request, and it won't prompt for confirmation.
To clairify, it goes like this:
Form gets sent via POST (User clicks on form)
Form gets processed
User gets redirected to the same page (via GET)
User now will be refreshing a GET request instead of a POST request.
I guess whenever your form (php, asps, static html etc) contains post information that may either form field infor or other, is sent to the server via firefox, it displays such a message before sending the data again to server. it serves as a security protection from Mozilla developers. I guess it can be disabled via about:config but it is not recommended to so.
Also it is a normal behaviour. It should be like this and have been like this for a fairly long time in firefox.
You may like to have a look here:
http://forums.mozillazine.org/viewtopic.php?f=38&t=682835&st=0&sk=t&sd=a&hilit=Firefox+must+send
alternatively use GET instead of POST to send your data...
Regards
If the form was submitted successfully, answer with the status code 303:
header('Location: http://www.example.com/', TRUE, 303);
This forces the browser to use a GET request for the resulting page. A reload won’t send any POST data, and no pop up is shown.
I have an application that supplies long list of parameters to a web page, so I have to use POST instead of GET. The problem is that when page gets displayed and user clicks the Back button, Firefox shows up a warning:
To display this page, Firefox must send information that will repeat any action (such as a search or order confirmation) that was performed earlier.
Since application is built in such way that going Back is a quite common operation, this is really annoying to end users.
Basically, I would like to do it the way this page does:
http://www.pikanya.net/testcache/
Enter something, submit, and click Back button. No warning, it just goes back.
Googling I found out that this might be a bug in Firefox 3, but I'd like to somehow get this behavior even after they "fix" it.
I guess it could be doable with some HTTP headers, but which exactly?
See my golden rule of web programming here:
Stop data inserting into a database twice
It says: “Never ever respond with a body to a POST-request. Always do the work, and then respond with a Location: header to redirect to the updated page so that browser requests it with GET”
If browser ever asks user about re-POST, your web app is broken. User should not ever see this question.
One way round it is to redirect the POST to a page which redirects to a GET - see Post/Redirect/Get on wikipedia.
Say your POST is 4K of form data. Presumably your server does something with that data rather than just displaying it once and throwing it away, such as saving it in a database. Keep doing that, or if it's a huge search form create a temporary copy of it in a database that gets purged after a few days or on a LRU basis when a space limit is used. Now create a representation of the data which can be accessed using GET. If it's temporary, generate an ID for it and use that as the URL; if it's a permanent set of data it probably has an ID or something that can be used for the URL. At the worst case, an algorithm like tiny url uses can collapse a big URL to a much smaller one. Redirect the POST to GET the representation of the data.
As a historical note, this technique was established practice in 1995.
One way to avoid that warning/behavior is to do the POST via AJAX, then send the user to another page (or not) separately.
I have been using the Session variable to help in this situation. Here's the method I use that has been working great for me for years:
//If there's something in the POST, move it to the session and then redirect right back to where we are
if ($_POST) {
$_SESSION['POST']=$_POST;
redirect($_SERVER["REQUEST_URI"]);
}
//If there's something in the SESSION POST, move it back to the POST and clear the SESSION POST
if ($_SESSION['POST']) {
$_POST=$_SESSION['POST'];
unset($_SESSION['POST']);
}
Technically you don't even need to put it back into a variable called $_POST. But it helps me in keeping track of what data has come from where.
I have an application that supplies long list of parameters to a web page, so I have to use POST instead of GET. The problem is that when page gets displayed and user clicks the Back button, Firefox shows up a warning:
Your reasoning is wrong. If the request is without side effects, it should be GET. If it has side effects, it should be POST. The choice should not be based on the number of parameters you need to pass.
As another solution you may stop to use redirecting at all.
You may process and render the processing result at once with no POST confirmation alert. You should just manipulate the browser history object:
history.replaceState("", "", "/the/result/page")
See full or short answers